cryptodao-contracts

MAL-2026-5975

Malicious code in cryptodao-contracts (npm)

Details


---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (21c450a1d14c10213b83137f9c0670a9d8ed953105f96d66eedee78a56479d82)
Package is published as version 99.99.99 to win private-vs-public resolution against an internal `cryptodao-contracts` namespace. The package's main module is a one-line stub; the real payload runs from the postinstall script `recon.js`. On `npm install`, recon.js enumerates a hardcoded list of installer-side secret environment variables (AWS_SECRET_ACCESS_KEY, SSH_PRIVATE_KEY, NPM_TOKEN, GITLAB_ACCESS_TOKEN, MNEMONIC, SEED_PHRASE, PRIVATE_KEY, DB_PASSWORD, etc.), reads `.env` files from installer-owned paths (`/root/.env`, `/app/.env`, `.env.production`), and grep-extracts lines matching KEY|SECRET|TOKEN|PASS|PRIVATE|MNEMONIC. The collected secrets, hostname, user, cwd, and CI build-directory listings are POSTed over HTTPS to two attacker-controlled endpoints, `webhook.site/d6d18927-e513-4df7-b019-58bfc64fe0dd` and `enqoojbegdvxj.x.pipedream.net`, with TLS verification disabled (`rejectUnauthorized: false`). Self-described in source as a 'CryptoDAO Dependency Confusion Reconnaissance Payload'.

Compromised versions (1)

99.99.99

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.